MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 5c2368af835dcd1c554187958ffb330dd18277eb2c38b25e770421299de8a094. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


ModiLoader


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 5c2368af835dcd1c554187958ffb330dd18277eb2c38b25e770421299de8a094
SHA3-384 hash: c419dcf46503ecf1c999f2fe459e1b67e202c6f2793a74817a15524d5048deb434e6836a5c97886a5264466bb1eeac5e
SHA1 hash: e208c49c2dea159bca493cccda0dfd495f5c1e99
MD5 hash: 90ccd2722230a06d12bfd2322551c304
humanhash: quiet-four-earth-edward
File name:PO_354688976.zip
Download: download sample
Signature ModiLoader
Create hunting rule
File size:591'242 bytes
First seen:2020-10-13 14:53:26 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 12288:eZ9wz4mI2qQlMCy8mtmn9lGMhZFWtygmnN5XQKxPHlUK9A:t4x2qhCYtmn9P4tyJ3/xDA
TLSH B2C423088505103D4C6657324B76A0227C85F2FBBEA179627B4FB3EDE69BDD01E05B8B
Reporter abuse_ch
Tags:ModiLoader zip


Avatar
abuse_ch
Malspam distributing unidentified malware:

HELO: cloudhost-1189763.au-south-1.nxcli.net
Sending IP: 103.224.90.90
From: Abdullah Hamad <info@kontec.ae>
Subject: RE: Standard New Order
Attachment: PO_354688976.zip (contains "PO_354688976.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
95
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
PUA.Win.Adware.Slugin-6803969-0
Create hunting rule

PUA.Win.Adware.Slugin-6840354-0
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/5c2368af835dcd1c554187958ffb330dd18277eb2c38b25e770421299de8a094/
Threat name:
Win32.Trojan.Generic
Create hunting rule
Status:
Suspicious
First seen:
2020-10-13 14:18:47 UTC
AV detection:
8 of 47 (17.02%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=lqrwrl4dlxgryvkbq6ky76ztbxiye57lfq4lextxaqqsthpiucka._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Trojan
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/5c2368af835dcd1c554187958ffb330dd18277eb2c38b25e770421299de8a094

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

ModiLoader

zip 5c2368af835dcd1c554187958ffb330dd18277eb2c38b25e770421299de8a094

(this sample)

ModiLoader

Executable exe 5cc6ce7f61d7f88aecd12284a5801e55ee4e000121eb9a85f2b5db16c8735a50

  
Dropping
MD5 e8ec4a87b67c8e8415acedc1dc96a74e
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 5cc6ce7f61d7f88aecd12284a5801e55ee4e000121eb9a85f2b5db16c8735a50

Comments